NAIC AI Model Bulletin: What It Requires, Which States Have Adopted It and How Insurers Show Compliance

What the NAIC AI model bulletin is, and what it is not

The National Association of Insurance Commissioners writes model laws, regulations and bulletins that state insurance departments can adopt. The Model Bulletin on the Use of Artificial Intelligence Systems by Insurers was adopted by the NAIC’s Innovation, Cybersecurity, and Technology (H) Committee on 1 December 2023 and by the Executive Committee and Plenary on 4 December 2023.

A bulletin is not a statute. It does not create new duties. It tells carriers how a department will read the laws they are already bound by when the decision in question was made or supported by AI. The bulletin names five model laws as its authority:

• the Unfair Trade Practices Model Act (#880);
• the Unfair Claims Settlement Practices Model Act (#900);
• the Corporate Governance Annual Disclosure Model Act (#305) and its regulation (#306);
• the Property and Casualty Model Rating Law (#1780), under which rates must not be excessive, inadequate or unfairly discriminatory;
• the Market Conduct Surveillance Model Law (#693), which frames how departments investigate.

Two definitions shape everything that follows. An AI system is a machine-based system that generates predictions, recommendations, content or other output influencing decisions, with varying levels of autonomy. That is broad enough to include a chat assistant drafting a claim letter as well as a pricing model. An adverse consumer outcome is a decision subject to insurance regulatory standards that hurts the consumer in a way that breaks those standards. The bulletin also defines the degree of potential harm to consumers, which drives how strict controls should be, and model drift, which examiners may ask about.

NAIC AI model bulletin summary: the four parts of an AIS program

Section 3 of the bulletin expects every insurer to develop, implement and maintain a written AIS program for AI systems that make or support decisions related to regulated insurance practices. Controls should match the risk, weighed against five factors: the nature of the decision, the type and degree of potential harm, how far humans are involved in the final decision, how transparent and explainable outcomes are to the consumer, and how much the insurer relies on third-party data and models.

1. General guidelines

The program should be designed to reduce the risk of adverse consumer outcomes. Responsibility sits with senior management accountable to the board or a board committee. The program may be part of enterprise risk management and may rely on a recognised framework, with the bulletin naming the NIST AI Risk Management Framework 1.0 as an example. It should span the insurance life cycle, from product design, marketing and underwriting to claims and fraud detection, cover every phase of a system from design to retirement, include vendor-built systems, and tell consumers when AI systems are in use.

2. Governance

The insurer should define policies and controls for each stage of a system’s life, documentation requirements written with an examination in mind, and an accountability structure. The bulletin suggests cross-functional committees drawing on underwriting, claims, actuarial, data science, compliance and legal, clear decision rights, independence between lines of defence, escalation and reporting, and staff training. For predictive models, it asks for documented methods to detect errors, performance issues, outliers and unfair discrimination.

3. Risk management and internal controls

This part covers approval of new or acquired systems, limits on automation, and data practices including lineage, quality, currency, bias analysis and suitability. For predictive models it asks for an inventory, detailed documentation, and assessments of interpretability, robustness, reproducibility, traceability, drift and auditability. It also asks for validation and retesting after implementation, protection of non-public information and of the models themselves, and record retention.

4. Third-party AI systems and data

Insurers should run due diligence on vendors and their data, and where possible include contract terms that give audit rights or access to independent audit reports and that require the vendor to cooperate with regulatory inquiries. They should then actually use those rights.

What examiners may ask for

Section 4 is the part compliance teams use most, because it lists the documents a department may request during an investigation or market conduct action, whether or not a written program exists. The requests fall into three groups.

Program documents. The written AIS program, evidence it was adopted, its scope, including any AI systems left out, how it is tailored to the insurer’s risk, and the policies, procedures and training behind it.

Evidence the program operates. Records of the committees that oversee AI, data lineage and bias analysis, the inventory of predictive models and AI systems that can lead to adverse consumer outcomes, and for any model under review, documentation of compliance with the program, the data used, the thresholds and controls applied, and validation, testing and drift monitoring. The bulletin adds that validation should reflect whether a system rests on predictive models or generative AI.

Third-party material. Due diligence on vendors, the contracts themselves, including warranties, data security, data sourcing, confidentiality and regulator cooperation terms, audits of vendor compliance, and the vendor’s validation and drift evidence.

The bulletin closes by saying its goal is not to prescribe specific practices or documents, and that insurers may demonstrate compliance in other ways. That flexibility is real, but an insurer that cannot produce an inventory or a testing record will struggle to show an alternative.

NAIC AI model bulletin state adoption map, October 2026

The NAIC publishes an implementation map of the bulletin. The version with status as of 8 October 2026 shows 29 adopting jurisdictions and four states with insurance-specific regulation or guidance of their own. The map records state action on the topic; it does not determine whether a state’s text contains every element of the model, so read each state’s own instrument rather than assuming it matches the NAIC text word for word.

Most adopting states issued the text as a bulletin; others used a different instrument, such as Washington’s technical assistance advisory, Virginia’s administrative letter, Pennsylvania’s insurance notice and Nebraska’s guidance document. Adoption has continued in 2026, so check the NAIC map and each department’s own bulletin before relying on this table.

States with their own approach

Colorado. SB21-169, signed in July 2021, prohibits insurers from using external consumer data and information sources, algorithms or predictive models in ways that unfairly discriminate based on race, colour, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity or gender expression. The Division of Insurance’s governance and risk management regulation, 3 CCR 702-10, took effect for life insurers in November 2023. An amended version, adopted on 20 August 2025 and effective 15 October 2025, also covers private passenger auto and health benefit plan insurers that use external consumer data.

New York. Insurance Circular Letter No. 7, dated 11 July 2024, covers AI systems and external consumer data used in underwriting and pricing. It asks insurers to show that these do not unfairly or unlawfully discriminate, through a test for disproportionate adverse effects, a check for a legitimate rationale and a search for less discriminatory alternatives. It expects board oversight, annual policy review and vendor accountability, saying an insurer may not rely solely on a vendor’s claim of non-discrimination, and it requires specific reasons in adverse decision notices.

California. Bulletin 2022-5, issued on 30 June 2022, addressed allegations of racial bias and unfair discrimination in marketing, rating, underwriting and claims, said algorithms and AI can carry the same biases, and reminded insurers to give specific reasons for adverse underwriting decisions.

Texas. The Department of Insurance lists Bulletin B-0036-20, dated 30 September 2020, on insurers’ use of third-party data.

Carriers writing in many states usually build one AIS program to the bulletin, then add Colorado’s and New York’s more specific testing and reporting duties for the lines they cover. The EU AI Act guide for banks and insurers covers the European layer for carriers with business there.

NAIC model bulletin 2026: the follow-on work

The bulletin was described from the start as a first step. Three strands of NAIC work have followed.

AI Risk Evaluation Supplement. The Big Data and Artificial Intelligence (H) Working Group developed a tool to help regulators gather consistent information on insurers’ AI use, governance, high-risk models and data inputs during market conduct exams, financial exams and financial analysis. First called the AI Systems Evaluation Tool, it was renamed the AI Risk Evaluation Supplement in 2026. A pilot with 12 participating states began in March 2026 and ran through September. Version 6.0 was exposed for a 14-day comment period ending 30 October 2026, and the NAIC has said it anticipates adoption at the 2026 Fall National Meeting, where the working group meets on 16 November.

Model law question. In May 2025 the working group issued a request for information, open for comment until 30 June, asking whether a model law on AI in insurance is needed, and how one might address governance, transparency and accountability, vendors and different lines of business. It received 33 written responses, with views split between relying on the bulletin and writing new law. No model law draft had been exposed as of 25 October 2026.

Third-party data and models. A separate NAIC group, formed as a task force in 2024 and since renamed a working group, is developing a framework for regulatory oversight of third-party data and model vendors.

The working group’s surveys of carriers continue to inform this work. The most recent, on health insurers, was published in May 2025 and found 92% of 93 responding health insurers using, planning to use or planning to explore AI or machine learning.

A practical compliance checklist

Use the bulletin’s own structure, and assume an examiner will ask for each item.

1. Board-approved AIS program. Written, owned by a named senior executive, reported to the board or a committee, and reviewed on a fixed cycle.
2. Scope statement. Which AI systems are in scope, which are out and why, across underwriting, rating, claims, fraud, marketing and servicing, including generative AI assistants used by staff.
3. Risk tiering. A method that rates each use case on the bulletin’s five factors and sets controls to match.
4. AI inventory. Every system, its purpose, business owner, model and version, data sources, vendor, risk tier and the human decision it supports.
5. Data controls. Lineage, quality, currency and suitability checks, with bias analysis for any external consumer data.
6. Validation and testing. Pre-deployment validation, post-implementation monitoring and drift checks, and testing for unfair discrimination, using quantitative methods where the line of business calls for them.
7. Human involvement. A documented point where a qualified person reviews or decides, especially for adverse decisions.
8. Consumer notice. How customers learn that AI is in use, and how adverse decision notices explain the reasons.
9. Vendor management. Due diligence before purchase, audit and regulator cooperation clauses, and periodic review of vendor evidence.
10. Records. Retention rules that keep prompts, outputs, sources, model versions and approvals long enough for a market conduct exam.

How an insurer evidences governance

The documents matter more than the policy wording. Four kinds of evidence carry most of the weight.

An inventory that is complete. Shadow use is the common gap: staff pasting claim notes into public chatbots, or vendor features switched on without review. Discovery through network logs, expense data and software catalogues, as described in the AI inventory and shadow AI discovery use case, feeds the inventory the bulletin expects.

Logs that reconstruct a decision. For any claim or underwriting file an examiner picks, the insurer should be able to show which AI system touched it, which model version, which documents it read, what it produced and who approved the outcome. That is far easier when every AI interaction is logged centrally than when each tool keeps its own records.

Testing records for unfair discrimination. Results of disparate impact testing, the metrics used, the thresholds set, the issues found and the changes made. The bias detection and fairness auditing use case outlines how such testing runs on a schedule and produces a reviewable report.

Vendor files. Due diligence questionnaires, contract clauses on audit rights and regulator cooperation, independent audit reports and the vendor’s own validation evidence. The vendor AI risk assessment use case shows a structured way to collect them.

How VDF AI fits an insurer’s AIS program

VDF AI is an AI platform that carriers install in their own data centre, private cloud or an isolated network segment. Configured with local models only, it keeps claim files, underwriting evidence, retrieval indexes and logs inside the insurer’s environment, which simplifies the data protection and third-party sections of an AIS program. VDF AI has no regulatory approval or certification of its own; it is one more system inside the insurer’s program, inventory and vendor review.

Several features line up with what the bulletin asks for. The audit trail records each interaction: the user, the model and version, the source passages retrieved and the tool calls made, which gives examiners the reconstruction described above. Governed agents get per-role tool grants, so a claims summarisation agent can read the claim file but cannot send letters, and a human approval step can be required before any output reaches a consumer. Permission-aware retrieval respects the access rights of each collection, keeping medical underwriting evidence away from staff who should not see it.

The VDF AI Router registers local open-weight models through Ollama, vLLM or other OpenAI-compatible endpoints, admits cloud models only where policy allows, and logs every call with its model and budget, which turns the inventory’s model-and-version column into a live record. On-premises sign-in uses Microsoft Entra ID single sign-on natively, other SAML or OIDC identity providers connect through an SSO-aware reverse proxy, and RBAC comes with every plan. Insurers that want to test it against their own program can start with a three-month platform trial on any seat bundle.

The insurance solution page and the insurance AI use case hub show the claims and underwriting workflows these controls support. The free AI agent governance and security handbook covers agent controls in more depth, and the AI readiness assessment shows where governance gaps might delay a first deployment. This article is general information, not legal advice on any state’s bulletin.